ScanMalware.com

Security Scan Report: 3mdtea.com

Site favicon
Submitted: Completed: publiccompleted

Summary

API
This view is built from:
Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/f3d1b8f6-e673-4fe8-911d-eda74e2c8993Domain and IP registration (RDAP)/api/v1/rdap/f3d1b8f6-e673-4fe8-911d-eda74e2c8993How often this domain was scanned/api/v1/domain/stats/3mdtea.comScan history for this domain/api/v1/domain/history/3mdtea.com?limit=15
This website contacted 19 IPs in 3 countries across 13 domains to perform 168 HTTP transactions. The main domain is 3mdtea.com and was registered 2 years 10 months ago.

Submitted URL: https://3mdtea.com

AI Security Verdict

High Risk

Confidence: 92%

9
Risk Score

Legitimate-looking UAE tea shop whose site appears compromised: analyst-vetted ClickFix/EtherHiding loader, 4 critical malware IDS alerts and ClearFake threat-intel hits mean visitors may be served a malware overlay.

Risk Factors (5)
Injected ClickFix/EtherHiding malware loader identified by analyst-vetted kit roster
CRITICAL IDS alerts for EtherHiding exfiltration (4x)
Primary domain flagged as ClearFake malware
Third-party ClearFake exploit-kit domain (interseq.at) loaded by the page
Blockchain smart-contract payload retrieval consistent with hidden malware distribution
Domain age information unavailable

Details

Page Title

3mdtea – متجر عميد الشاي

Scan Type

public

Domain Name Analysis

You're looking at domain '3mdtea.com' on the commercial generic top-level domain (.com) with no subdomain. Its registrable label '3mdtea' stretches across 6 characters holding 2 vowels versus three consonants, plus 1 digit. Segmentation suggests three words: 3, md, tea. Expect two characters per word on average. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of https://3mdtea.com

Page Load Overview

75.10s
Total Load Time
1.4 MB
Total Size

Language Analysis

Primary Language

🇸🇦Arabic
Code: ar
Confidence:80%
Script:Arabic
Direction:rtl

Detection Details

HTML Lang Attribute:ar
Text Length:1,357 chars
Detector Agreement:100%

Website Classification

Primary Category

corporate business81% confidence
Type: spa
Method: ml+structural

All Detected Categories

corporate business
81%
e-commerce shopping
80%
government public service
75%
finance banking
72%
adult content
70%

Detected Features

Search
Articles

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
24160.153.0.201Cloudflare · CDNUnited States
AS209242Cloudflare London, LLC
8104.20.38.203Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
8104.26.5.88Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
8142.251.13.95Google · CDNUnited States
AS15169Google LLC
8104.18.5.153Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
813.226.244.127Cloudfront · CDNUnited States
AS16509Amazon.com, Inc.
8193.233.126.164Amsterdam, North Holland, Netherlands
AS209207Digital Hosting Provider LLC
823.207.210.148Akamai · CDNFrankfurt am Main, Hesse, Germany
AS20940Akamai International B.V.
8188.114.97.3Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
8192.178.183.94Google · CDNUnited States
AS15169Google LLC
16819--

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T11215D072B7A02435126F13AEE44BB78878665A23D6DD13F6F5BE811447CAF82317360E

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

12288:Xjz86QI8CCF1wejlpEF612VK4S5uW8vt62nF/ZpFtC0abGAMCsTdVi:zz8F9CCF1ZEpVK4esFtDCsHi

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:875515:JDVIFoF4vJAlQ1kg4IRgRkoClSkGJSAAbiHhQwBEVQIABCKsocAEDaNZASEqUA9AhUgwdDQHBkEskixAsnkBywKwAMIJQYiA

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:01001000000100ff
Perceptual Hash:aa0dff2ba322cc32
Difference Hash:6931311509214d0d
Wavelet Hash:01193b232131c3ff
Color Hash:#563a78

Other Hashes

Crop Resistant:6931311509214d0d,b484d595d4456b59,6131301408280c4c

Scan History

Scan history not available

Unable to load historical scan data